Service Graph Connector for Microsoft Defender Endpoint – CMDB Data Quality Concerns

[RBfleming]

We installed the Service Graph Connector for Microsoft Defender Endpoint with the expectation that Microsoft Defender discovery data would be used to populate and enrich our CMDB.

After implementation, however, we found that thousands of records were being created in the Computer table with very limited information. In some cases, if only an IP address or MAC address was identified, a Computer CI was still created.

We initially contacted Microsoft to better understand the behavior and identified three critical concerns. During those discussions, Microsoft clarified that the connector and its implementation are owned by ServiceNow rather than Microsoft.

We then contacted ServiceNow and were informed that the out-of-box integration does not include a default mechanism for managing devices that have not been onboarded into Defender. Instead of placing these records into a staging or "unknown device" area where customers can evaluate them and apply qualification rules, the integration can result in records being created directly in the Computer table.

Has anyone else implemented this connector and encountered similar CMDB data-quality concerns? If so, how are you addressing them?

We would like to utilize the connector to support our Security team, but we also need to ensure that doing so does not negatively impact the integrity and quality of the CMDB based on the current OOB implementation.

Any lessons learned, configuration approaches, or has anyone else contacted ServiceNow about this plugin? According to Microsoft, several customers have discussed this with them so curious if anyone came up with a possible solution that they are willing to share or discuss.

Thanks in advance.